[Security Architecture] A senior security engineer flags the following log file snippet as having likely facilitated an attacker’s lateral movement…

The log snippet indicates a successful DNS zone transfer (qrytype: AXFR) was executed from an external IP address (19.27.214.22). This type of query allows an attacker to download the entire DNS zone file, revealing the internal network topology, hostnames, and IP addresses of sensitive servers (e.g., directoryserver1, msn-crit-apcs). This information is invaluable for reconnaissance and subsequent lateral movement. The most direct and effective mitigation is to configure the DNS server to disable or strictly control zone transfers, permitting them only from the IP addresses of authorized secondary DNS servers and denying all others.

B. Restricting DNS traffic to UDP/53: This is incorrect because while most standard queries use UDP, zone transfers and large responses legitimately require TCP. Blocking TCP/53 entirely would break necessary DNS functions.

C. Implementing DNS masking on internal servers: This is incorrect because while split-horizon DNS is a good practice, it does not prevent the zone transfer itself. A misconfigured server could still allow the transfer of the internal zone view.

D. Permitting only clients from internal networks to query DNS: This is incorrect as it would block all legitimate external queries for public resources (e.g., the company website), rendering public-facing services inaccessible to the internet.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-81-2

Secure Domain Name System (DNS) Deployment Guide. Section 3.3.1

"Restrict Zone Transfers

" states

"Zone transfers should be restricted to prevent unauthorized users from obtaining a copy of a zone’s contents... DNS servers should be configured to allow zone transfers only to explicitly authorized servers." This directly supports disabling open zone transfers. (Page 16).

2. Internet Systems Consortium (ISC)

BIND 9.18.24 Administrator Reference Manual. The documentation for the allow-transfer option specifies its use for creating an access control list (ACL) of hosts permitted to receive zone transfers. The default is to allow transfers to all hosts

which is insecure. The manual guides administrators to restrict this to only known

trusted secondary servers. (Section: "The allow-transfer option").

3. University of California

Berkeley. CS 161: Computer Security

Lecture 18: Network Security II. Course materials discuss DNS security vulnerabilities

explicitly identifying zone transfers (AXFR) as a method for attackers to map an entire internal network. The recommended countermeasure is to configure DNS servers to restrict zone transfers to only authorized secondary name servers.